SB2022080609 - Amazon Linux AMI update for tomcat8

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022080609

SB2022080609 - Amazon Linux AMI update for tomcat8

Published: August 6, 2022 Updated: October 25, 2024

Security Bulletin ID SB2022080609
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Error Handling (CVE-ID: CVE-2022-25762)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to an error when handling WebSocket connections. If a web application sends a WebSocket message concurrently with the WebSocket connection closing, it is possible that the application will continue to use the socket after it has been closed. As a result, subsequent connections can use the same object concurrently and share data and/or other errors.


2) Data Handling (CVE-ID: CVE-2022-29885)

The vulnerability allows a remote attacker to perform DoS attack.

The vulnerability exists due to an error in documentation for the EncryptInterceptor, which incorrectly stated that it enabled Tomcat clustering to run over an untrusted network. A remote attacker can perform a denial of service attack against the exposed EncryptInterceptor.


Remediation

Install update from vendor's website.

References